DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:to:from:subject:message-id:date:mime-version
	:content-type:content-transfer-encoding; q=dns; s=default; b=hY5
	mhhQ1V7wpNwhGz/PACYKAf5+P65RYsRkD0mVknc6ZRyS2DQrFyaiGRATrL90aPP6
	RmGRoE2QcSLafSRdAAnroYSFVXjSnfDhmzQzXAz9phCfzPCUtMBGQ9v8Bou8fzVt
	bwuWq7C9CDCCa6ef8IxsRQKeM0sLN4XIdKjEqOck=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
To: cygwin AT cygwin DOT com
From: Thomas Wolff <towo AT towo DOT net>
Subject: setfacl to remove a permission implicit adds another
Message-ID: <5674265F.2040902@towo.net>
Date: Fri, 18 Dec 2015 16:29:35 +0100
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit

For my Desktop folder (as logged below), SYSTEM had group write permission,
other groups did not have write permissions (by mask).
After removing SYSTEM write permission with setfacl,
it was effectively removed for SYSTEM but the other groups got
write permission ADDED instead (as also properly indicated by ls) −
which is kind of the opposite of the intended operation.
Only after removing group write permission with chmod,
a suitable mask was reestablished, effectively restoring the previous 
setting.
Why did this specific setfacl operation affect the mask at all?

I know there will be some trade-off in POSIX/Windows interworking ACL 
handling,
and the current mechanism has undergone a long phase of considerations
and changes, so if this trade-off is better than others, so be it.
Just wondering.

Kind regards,
Thomas

NB: The purpose of this setting is to prevent stubborn IT management 
procedures from cluttering my desktop with their useless icons:/

user[en_US.UTF-8]:/cygdrive/c/Users/Public: getfacl Desktop
# file: Desktop/
# owner: user
# group: Administrators
user::rwx
group::---
group:BATCH:rwx                         #effective:r-x
group:INTERACTIVE:rwx                   #effective:r-x
group:SERVICE:rwx                       #effective:r-x
group:SYSTEM:rwx
group:Administrators:---
mask:r-x
other:---
default:user::rwx
default:group::---
default:group:BATCH:rwx
default:group:INTERACTIVE:rwx
default:group:SERVICE:rwx
default:group:SYSTEM:rwx
default:mask:rwx
default:other:---

user[en_US.UTF-8]:/cygdrive/c/Users/Public: setfacl -m group:SYSTEM:r-x 
Desktop
user[en_US.UTF-8]:/cygdrive/c/Users/Public: getfacl Desktop
# file: Desktop/
# owner: user
# group: Administrators
user::rwx
group::---
group:BATCH:rwx
group:INTERACTIVE:rwx
group:SERVICE:rwx
group:SYSTEM:r-x
group:Administrators:---
mask:rwx
other:---
default:user::rwx
default:group::---
default:group:BATCH:rwx
default:group:INTERACTIVE:rwx
default:group:SERVICE:rwx
default:group:SYSTEM:rwx
default:mask:rwx
default:other:---

user[en_US.UTF-8]:/cygdrive/c/Users/Public: ls -ld Desktop
total 9
drwxrwx---+ 1 user       Administrators   0 Dec 18 11:07 Desktop
...
user[en_US.UTF-8]:/cygdrive/c/Users/Public: chmod g-w Desktop
user[en_US.UTF-8]:/cygdrive/c/Users/Public: ls -ld Desktop
total 9
drwxr-x---+ 1 user       Administrators   0 Dec 18 11:07 Desktop
...
user[en_US.UTF-8]:/cygdrive/c/Users/Public: getfacl Desktop
# file: Desktop/
# owner: user
# group: Administrators
user::rwx
group::---
group:BATCH:rwx                         #effective:r-x
group:INTERACTIVE:rwx                   #effective:r-x
group:SERVICE:rwx                       #effective:r-x
group:SYSTEM:r-x
group:Administrators:---
mask:r-x
other:---
default:user::rwx
default:group::---
default:group:BATCH:rwx
default:group:INTERACTIVE:rwx
default:group:SERVICE:rwx
default:group:SYSTEM:rwx
default:mask:rwx
default:other:---


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple